TMA-CHROME-1.11

Ensure 'Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes' is set to 'Disabled'

ВисокаНиво 1Аутоматскаchrome

Опис

Google Chrome can exclude certificates by their subjectPublicKeyInfo hashes from enforcing Certificate Transparency requirements. If this setting is disabled, no certificates are excluded from Certificate Transparency requirements. The recommended state for this setting is: Disabled (0) Rationale: Certificate Transparency requirements shall be enforced for all certificates. The policy is Disabled when it is not present: the audit prints 'absent' when the list key HKLM\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForCas is missing or empty, otherwise the configured entries.

Како се проверава

Метод провере: Windows регистар

registry

$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForCas' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); if ($l.Count -eq 0) { 'absent' } else { 'configured: ' + ($l -join ', ') }

Очекивани излаз: absent

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Configure through Group Policy: Computer Configuration\Policies\Administrative Templates\Google\Google Chrome\Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes = Disabled. Locally, remove the policy entries at HKLM\SOFTWARE\Policies\Google\Chrome\CertificateTransparencyEnforcementDisabledForCas after reviewing them.

Својства

Оперативни системи: Било који
Ознаке: chromebrowsercis-l1
Референца: CIS Google Chrome Benchmark v3.0.0 - 1.11 Ensure 'Disable Certificate Transparency enforcement for a list of subjectPublicKeyInfo hashes' is set to 'Disabled'

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target chrome